some more feedback:
I had some difficulty about how to find the correct IP-Address to be put in file application.properties, Parameter ipAddressesAllowed. This happened in an installation where both, the Oracle-DB and JRI, are on the same machine.
while the line in the Configuration Info (see image above, highlighted in green) gives 127.0.0.1 for localhost, the Oracle-DB, ACL-system, uses the IPv6-address of the host.
Solution which did help me:
tomcat does log the connections: right after the try to open a report I look in the file ...\tomcat\logs\localhost_access_log.yyyy-mm-dd.txt (there ist one file per day having the actual date in its name). In the last line (if there was no other connection inbetween) I recognize the GET to open the report. First entry in that line ist the IP-address which oracle-ACL did use to GET the report from jri. It added this IP address in ipAddressesAllowed, restarted tomcat ... and the report did show up!
Win Server 2016 Standard (in a VMWare VM)
Oracle DB 12c Standard Edition, 18.104.22.168.0